Chung-En Lee created HDDS-17480:
-----------------------------------
Summary: PutObject to a trailing-slash key without Content-Length
creates a directory and discards the payload
Key: HDDS-17480
URL: https://issues.apache.org/jira/browse/HDDS-17480
Project: Apache Ozone
Issue Type: Bug
Reporter: Chung-En Lee
In FSO buckets, a PutObject to a key ending with "/" that has no Content-Length
header is treated as directory creation, even when x-amz-decoded-content-length
is non-zero. S3 Gateway returns 200, creates a directory and silently discards
the payload.
aws-cli sends exactly this request when it talks to S3 Gateway over HTTPS. It
uses STREAMING-UNSIGNED-PAYLOAD-TRAILER with Transfer-Encoding: chunked and
removes the Content-Length header.
h3. Environment
* Ozone 2.2.1 (apache/ozone:2.2.1 docker image), non-secure cluster. master has
the same code.
* S3 Gateway serving HTTPS: ozone.http.policy=HTTPS\_ONLY, with the keystore
configured in ssl-server.xml (ssl.server.keystore.location,
ssl.server.keystore.password, ssl.server.keystore.keypassword,
ssl.server.keystore.type).
* ozone.s3g.fso.directory.creation=true (default).
* aws-cli 2.38.1.
h3. Steps to reproduce
# Create an FSO bucket:
{code}ozone sh bucket create /s3v/fsobucket --layout FILE_SYSTEM_OPTIMIZED
{code}
# Upload 5 bytes to a key ending with "/" over HTTPS:
{code}printf 'hello' > 5bytes.txt
aws --endpoint-url https://<s3g-host>:9879 --no-verify-ssl s3api put-object
--bucket fsobucket --key dir1/ --body 5bytes.txt
{code}
# Read the object back and list the bucket:
{code}aws --endpoint-url https://<s3g-host>:9879 --no-verify-ssl s3api
get-object --bucket fsobucket --key dir1/ out.txt
ozone fs -ls ofs://om/s3v/fsobucket/
{code}
Request headers sent by aws-cli in step 2 (from --debug). There is no
Content-Length header:
{code}Transfer-Encoding: chunked
Content-Encoding: aws-chunked
X-Amz-Content-SHA256: STREAMING-UNSIGNED-PAYLOAD-TRAILER
X-Amz-Decoded-Content-Length: 5
X-Amz-Trailer: x-amz-checksum-crc64nvme
{code}
h3. Expected
The payload is not silently lost: either it is stored, or the request fails
with an error.
h3. Actual
* put-object returns 200.
* get-object returns ContentLength 0.
* dir1 is a directory and the 5 bytes are gone:
{code}drwxrwxrwx - testuser hadoop 0 2026-10-26 10:03
ofs://om/s3v/fsobucket/dir1
{code}
h3. Control
The same upload with a precomputed checksum makes aws-cli send Content-Length:
5 without a trailer. In that case the data is stored, as a 5-byte file named
dir2:
{code}aws --endpoint-url https://<s3g-host>:9879 --no-verify-ssl s3api
put-object --bucket fsobucket --key dir2/ --body 5bytes.txt --checksum-crc32
NhCmhg==
{code}
{code}-rw-rw-rw- 1 testuser hadoop 5 2026-10-26 10:03
ofs://om/s3v/fsobucket/dir2
{code}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
